Skip to content

Conversation

@5kt
Copy link
Contributor

@5kt 5kt commented Oct 30, 2025

What this PR does / why we need it:
After some internal discussions we decided to keep the IMA configs same as Debian upstream.
The current IMA configuration is hindering us from using the Nvidia gpu operator as the firmware is unable to be loaded because it is not signed - problematic option is CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS

The default config for IMA used upstream is already in the main config.

CONFIG_IMA=y
CONFIG_IMA_SIG_TEMPLATE=y
# CONFIG_IMA_DEFAULT_HASH_SHA1 is not set
CONFIG_IMA_DEFAULT_HASH_SHA256=y
# CONFIG_IMA_DEFAULT_HASH_SHA512 is not set
# CONFIG_IMA_DEFAULT_HASH_WP512 is not set
# CONFIG_IMA_WRITE_POLICY is not set
# CONFIG_IMA_READ_POLICY is not set
CONFIG_IMA_APPRAISE=y
CONFIG_IMA_ARCH_POLICY=y

Which issue(s) this PR fixes:
Fixes #

@5kt 5kt marked this pull request as ready for review October 30, 2025 06:53
Copy link
Contributor

@Akendo Akendo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants